PT-2023-19964 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro versions prior to 7.2 Description: The issue allows users to execute arbitrary commands on the hub device when logged into the superuser account, due to a new functionality that appears in affected versions. Recommendations:...

PT-2023-23261 · Snap One · Ovrc Pro

Name of the Vulnerable Software and Affected Versions: Snap One OvrC Pro versions prior to 7.2 Description: The issue concerns a locally running web server in Snap One OvrC Pro that is accessible from both the local network and remotely. Additionally, there is a hidden superuser account in OvrC...

CVE-2018-16850 - SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING.

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.More at:...

Snap One OvrC Pro 安全漏洞

Snap One OvrC is a free cloud-based remote management and monitoring platform from Snap One USA. A security vulnerability exists in Snap One OvrC Pro prior to version 7.3, which stems from a vulnerability that could allow a user to execute arbitrary commands on a hub device when logged in as a...

CVE-2023-32305

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the...

Privilege escalation

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the...

CVE-2023-32305

CVE-2023-32305 affects the PostgreSQL extension aiven-extras . The root cause is missing schema qualifiers on privileged functions called by the extension, allowing a low-privilege user to create objects that collide with existing function names and have them executed, enabling escalation to the ...

CVE-2023-32305 aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the...

CVE-2023-32305 aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the...

PT-2023-2939 · Aiven · Aiven-Extras

Name of the Vulnerable Software and Affected Versions: aiven-extras versions prior to 1.1.9 Description: The issue is related to a privilege escalation vulnerability in the aiven-extras PostgreSQL extension. It allows a low-privileged user to elevate to superuser inside PostgreSQL databases that...

aiven-extras 安全漏洞

aiven-extras is a tool that enables non-super users to access certain database functions. A security vulnerability exists in aiven-extras versions prior to 1.1.9, which contains an elevation of privilege vulnerability that can be exploited by an attacker to gain superuser privileges, allowing...

CVE-2023-1778

This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 except v4.21 due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby...

Default credentials

This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 except v4.21 due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby...

CVE-2023-1778 Default Credential Vulnerability in GajShield Data Security Firewall

This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 except v4.21 due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby...

CVE-2023-1778

The CVE-2023-1778 issue affects GajShield Data Security Firewall firmware versions prior to 4.28 (except 4.21). The root cause is insecure default credentials that allow a remote attacker to log in as superuser via the web management interface and/or exposed SSH port, enabling remote command exec...

PT-2023-17238 · Gajshield · Gajshield Data Security Firewall

Name of the Vulnerable Software and Affected Versions: GajShield Data Security Firewall versions prior to v4.28 except v4.21 Description: This issue exists due to insecure default credentials, allowing a remote attacker to login as a superuser by using the default username and password via the...

Gipsy 操作系统命令注入漏洞

Gipsy is a modular, free, open source Discord robot from Curiosity Open Source. An operating system command injection vulnerability exists in Gipsy versions prior to 1.3. An attacker exploiting this vulnerability could use sudoer privileges to run commands on the host...

Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family (CVE-2012-6354)

Problem Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family CVE-2012-6354 Resolving The Problem Security Bulletin --- Summary --- Administrative access to the system via the GUI may be obtained without supplying proper credentials. Vulnerability...

SUSE CVE-2008-3825

pamkrb5 2.2.14 in Red Hat Enterprise Linux RHEL 5 and earlier, when the existingticket option is enabled, uses incorrect privileges when reading a Kerberos credential cache, which allows local users to gain privileges by setting the KRB5CCNAME environment variable to an arbitrary cache filename a...

SUSE CVE-2009-4136

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain...